{"id":14109314,"url":"https://github.com/PalindromeLabs/awesome-websocket-security","last_synced_at":"2025-08-01T08:31:31.017Z","repository":{"id":40490250,"uuid":"426813751","full_name":"PalindromeLabs/awesome-websocket-security","owner":"PalindromeLabs","description":"Awesome information for WebSockets security research","archived":false,"fork":false,"pushed_at":"2022-01-10T16:57:24.000Z","size":19,"stargazers_count":271,"open_issues_count":0,"forks_count":28,"subscribers_count":12,"default_branch":"main","last_synced_at":"2025-07-04T00:02:19.068Z","etag":null,"topics":["security","security-tools","web-application-security","websocket","websocket-security","websockets","websockets-security"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/PalindromeLabs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-11-10T23:51:28.000Z","updated_at":"2025-07-03T00:16:11.000Z","dependencies_parsed_at":"2022-08-01T07:59:14.639Z","dependency_job_id":null,"html_url":"https://github.com/PalindromeLabs/awesome-websocket-security","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/PalindromeLabs/awesome-websocket-security","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PalindromeLabs%2Fawesome-websocket-security","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PalindromeLabs%2Fawesome-websocket-security/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PalindromeLabs%2Fawesome-websocket-security/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PalindromeLabs%2Fawesome-websocket-security/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/PalindromeLabs","download_url":"https://codeload.github.com/PalindromeLabs/awesome-websocket-security/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PalindromeLabs%2Fawesome-websocket-security/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":268192549,"owners_count":24210539,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-01T02:00:08.611Z","response_time":67,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["security","security-tools","web-application-security","websocket","websocket-security","websockets","websockets-security"],"created_at":"2024-08-14T10:02:13.644Z","updated_at":"2025-08-01T08:31:30.993Z","avatar_url":"https://github.com/PalindromeLabs.png","language":null,"funding_links":[],"categories":["Other Awesome Lists","Other Lists","Useful Resources"],"sub_categories":["Other Security Awesome Lists","TeX Lists","Security Awesome Lists"],"readme":"# Awesome WebSockets Security\n\n[![Awesome](https://cdn.rawgit.com/sindresorhus/awesome/d7305f38d29fed78fa85652e3a63e154dd8e8829/media/badge.svg)](https://github.com/sindresorhus/awesome)\n\nA collection of CVEs, research, and reference materials related to WebSocket security\n\n------\n\n## Contents\n\n- [WebSocket Library Vulnerabilities](#websocket_library_vulnerabilities)\n- [Conference Talks](#conference_talks)\n- [Common WebSocket Weaknesses](#common_weaknesses)\n- [WebSocket Security Tools](#websocket_security_tools)\n- [Bug Bounty Writeups](#bug_bounty_writeups)\n- [Useful blog posts](#useful_blogs)\n\n------\n\n## \u003ca name=\"websocket_library_vulnerabilities\"\u003e\u003c/a\u003eWebSocket Library Vulnerabilities\n\nThis list of vulnerabilities attempts to capture WebSocket CVEs and\nrelated issues in commonly encountered WebSockets server implementations.\n\n| CVE ID | Vulnerable package | Related writeup | Vulnerability summary |\n| :---- | :---------- | :-------------------- | :------ |\n| [CVE-2021-42340](https://nvd.nist.gov/vuln/detail/CVE-2021-42340) | [Tomcat](https://github.com/uNetworking/uWebSockets) | [Apache mailing list](https://lists.apache.org/thread.html/r83a35be60f06aca2065f188ee542b9099695d57ced2e70e0885f905c%40%3Cannounce.tomcat.apache.org%3E) | DoS memory leak |\n| [CVE-2021-33880](https://nvd.nist.gov/vuln/detail/CVE-2021-33880) | [Python websockets](https://github.com/aaugustin/websockets) | [GitHub Advisory](https://github.com/advisories/GHSA-8ch4-58qp-g3mp) | HTTP basic auth timing attack |\n| [CVE-2021-32640](https://nvd.nist.gov/vuln/detail/CVE-2021-32640) | [ws](https://github.com/websockets/ws) | [GitHub Advisory](https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693) | Regex backtracking Denial of Service |\n| [CVE-2020-36406](https://nvd.nist.gov/vuln/detail/CVE-2020-36406) | [uWebSockets](https://github.com/uNetworking/uWebSockets) | [OSS Fuzz Summary](https://github.com/google/oss-fuzz-vulns/blob/main/vulns/uwebsockets/OSV-2020-1695.yaml) | Stack buffer overflow |\n| [CVE-2020-27813](https://nvd.nist.gov/vuln/detail/CVE-2020-27813) | [Gorilla](https://github.com/gorilla/websocket) | [GitHub Advisory](https://github.com/gorilla/websocket/security/advisories/GHSA-jf24-p9p9-4rjh) | Integer overflow |\n| [CVE-2020-24807](https://nvd.nist.gov/vuln/detail/CVE-2020-24807) | [socket.io-file](https://github.com/rico345100/socket.io-file) | [Auxilium Security](https://blog.auxiliumcybersec.com/?p=2646) | File type restriction bypass |\n| [CVE-2020-15779](https://nvd.nist.gov/vuln/detail/CVE-2020-15779) | [socket.io-file](https://github.com/rico345100/socket.io-file) | [Auxilium Security](https://blog.auxiliumcybersec.com/?p=2586) | Path traversal |\n| [CVE-2020-15134](https://nvd.nist.gov/vuln/detail/CVE-2020-15134) | [faye-websocket](https://github.com/faye/faye-websocket-ruby) | [GitHub advisory](https://github.com/faye/faye/security/advisories/GHSA-3q49-h8f9-9fr9) | Lack of TLS certificate validation |\n| [CVE-2020-15133](https://nvd.nist.gov/vuln/detail/CVE-2020-15133) | [faye-websocket](https://github.com/faye/faye-websocket-ruby) | [GitHub advisory](https://github.com/faye/faye-websocket-ruby/security/advisories/GHSA-2v5c-755p-p4gv) | Lack of TLS certificate validation |\n| [CVE-2020-11050](https://nvd.nist.gov/vuln/detail/CVE-2020-11050) | [Java WebSocket](https://tootallnate.github.io/Java-WebSocket/) | [GitHub advisory](https://github.com/TooTallNate/Java-WebSocket/security/advisories/GHSA-gw55-jm4h-x339) | SSL hostname validation not performed |\n| [CVE-2020-7663](https://nvd.nist.gov/vuln/detail/CVE-2020-7663) | [Ruby websocket-extensions](https://rubygems.org/gems/websocket-extensions) | [Writeup](https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions/) | Regex backtracking Denial of Service |\n| [CVE-2020-7662](https://nvd.nist.gov/vuln/detail/CVE-2020-7662) | [npm websocket-extensions](https://rubygems.org/gems/websocket-extensions) | [Writeup](https://snyk.io/blog/regular-expression-denial-of-service-in-websocket-extensions/) | Regex backtracking Denial of Service |\n| None | [Socket.io](https://github.com/socketio/socket.io) | [GitHub Issue](https://github.com/socketio/socket.io/issues/3671) | CORS misconfiguration |\n| [CVE-2018-1000518](https://nvd.nist.gov/vuln/detail/CVE-2018-1000518) | [Python websockets](https://github.com/aaugustin/websockets) | [GitHub PR](https://github.com/aaugustin/websockets/pull/407) | DoS via memory exhaustion when decompressing compressed data |\n| None | [Tornado](https://github.com/tornadoweb/tornado) | [GitHub PR](https://github.com/tornadoweb/tornado/pull/2391) | DoS via memory exhaustion when decompressing compressed data |\n| [CVE-2018-21035](https://nvd.nist.gov/vuln/detail/CVE-2018-21035) | [Qt WebSockets](https://doc.qt.io/qt-5/qtwebsockets-index.html) | [Bug report](https://bugreports.qt.io/browse/QTBUG-70693) | Denial of service due large limit on message and frame size |\n| [CVE-2017-16031](https://nvd.nist.gov/vuln/detail/CVE-2017-16031) | [socket.io](https://socket.io/) | [GitHub Issue](https://github.com/socketio/socket.io/issues/856) | Socket IDs use predictable random numbers |\n| [CVE-2016-10544](https://nvd.nist.gov/vuln/detail/CVE-2016-10544) | [uWebSockets](https://github.com/uNetworking/uWebSockets) | [npm advisory](https://www.npmjs.com/advisories/149) | Denial of service due to large limit on message size |\n| [CVE-2016-10542](https://nvd.nist.gov/vuln/detail/CVE-2016-10542) | [NodeJS ws](https://www.npmjs.com/package/ws) | [npm advisory](https://www.npmjs.com/advisories/120) | Denial of service due to large limit on message size |\n| None | [draft-hixie-thewebsocketprotocol-76](https://tools.ietf.org/html/draft-hixie-thewebsocketprotocol-76) | [Writeup](https://webcache.googleusercontent.com/search?q=cache:oPoZu0vomjYJ:https://www.ietf.org/mail-archive/web/hybi/current/msg04744.html+\u0026cd=1\u0026hl=en\u0026ct=clnk\u0026gl=us) |  |\n\n------\n\n## \u003ca name=\"conference_talks\"\u003e\u003c/a\u003eConference Talks, Papers, Notable Blog Posts\n\n## 2011\n\n- Talking to Yourself for Fun and Profit [Paper](http://www.adambarth.com/papers/2011/huang-chen-barth-rescorla-jackson.pdf)\n\n### 2012\n\n- Blackhat 2012 - Mike Shema, Sergey Shekyan, Vaagn Toukharian - Hacking with WebSockets [Video](https://www.youtube.com/watch?v=-ALjHUqSz_Y)\n\n### 2019\n\n- Hacktivity 2019 - Mikhail Egorov - What’s Wrong with WebSocket APIs? Unveiling Vulnerabilities in WebSocket APIs [Video](https://www.youtube.com/watch?v=gANzRo7UHt8)\n- DerbyCon 2019 - Michael Fowl, Nick Defoe - Old Tools New Tricks Hacking WebSockets [Video](https://www.youtube.com/watch?v=MhxayMPknFI)\n\n### 2021\n\n- OWASP Global AppSec US 2021 - Erik Elbieh - We’re not in HTTP anymore: Investigating WebSocket Server Security [Tool](https://github.com/PalindromeLabs/STEWS) [Paper](https://github.com/PalindromeLabs/STEWS/blob/main/paper.pdf) [Video](https://www.youtube.com/watch?v=bMFP71UAbPo)\n\n\n------\n\n## \u003ca name=\"common_websocket_weaknesses\"\u003e\u003c/a\u003eCommon WebSocket Weaknesses\n\n### Unencrypted WebSockets\n\u003c!-- markdown-link-check-disable-next-line --\u003e\n- Black Hills WebSocket testing guide: [Link](https://www.blackhillsinfosec.com/how-to-hack-websockets-and-socket-io/)\n\n### Cross-Site WebSocket Hijacking (CSWSH)\n- Original CSWSH blog post by Christian Schneider: [Link](https://christian-schneider.net/CrossSiteWebSocketHijacking.html)\n- PortSwigger Web Academy CSWSH lab: [Link](https://portswigger.net/web-security/websockets/cross-site-websocket-hijacking)\n\n### Insecure Authentication Mechanism\n- Stratum Security blog post: [Link](https://blog.stratumsecurity.com/2016/06/13/websockets-auth/)\n- Heroku WebSocket Security: [Link](https://devcenter.heroku.com/articles/websocket-security#authentication-authorization)\n\n### Reverse Proxy Bypass using Upgrade Header\n- Mikhail Egorov's initial PoC from Hacktivity 2019: [Link](https://github.com/0ang3el/websocket-smuggle)\n- Jake Miller's HTTP 2 smuggling tool based on Mikhail's PoC work: [Link](https://github.com/BishopFox/h2csmuggler)\n- AssetNote blog post with golang h2smuggler tool: [Link](https://blog.assetnote.io/2021/03/18/h2c-smuggling/)\n\n## DOM-based WebSocket-URL poisoning\n- Portswigger summary: [Link](https://portswigger.net/web-security/dom-based/websocket-url-poisoning)\n\n------\n\n## \u003ca name=\"useful_blogs\"\u003e\u003c/a\u003eUseful Blog Posts \u0026 Resources\n\n- Portscanning using WebSockets [Link](https://medium.com/@stestagg/stealing-secrets-from-developers-using-websockets-254f98d577a0)\n- WebSocket fuzzing with Kitty fuzzing framework [Link](https://snikt.net/blog/2019/05/22/to-fuzz-a-websocket/)\n- WebSocket fuzzing harness [Link](https://vdalabs.com/2019/03/05/hacking-web-sockets-all-web-pentest-tools-welcomed/)\n- Project Zero WebSockets-based buffer overflow [Link](https://googleprojectzero.blogspot.com/2020/02/several-months-in-life-of-part2.html)\n- Reserved Extension, Subprotocol values [Link](https://www.iana.org/assignments/websocket/websocket.xml#subprotocol-name)\n\n------\n\n## \u003ca name=\"websocket_security_tools\"\u003e\u003c/a\u003eWebSocket Security Tools\n\n### Discovery, Fingerprinting, Vulnerability Detection\n- STEWS [GitHub](https://github.com/PalindromeLabs/STEWS)\n\n### Fuzzing\n- websocket-fuzzer [GitHub](https://github.com/andresriancho/websocket-fuzzer)\n- websocket-harness [GitHub](https://github.com/VDA-Labs/websocket-harness)\n\n### Playgrounds\n- DVWS: A purposefully vulnerable WebSocket demo [GitHub](https://github.com/interference-security/DVWS)\n- WebSocket-Playground: Jumpstart multiple WebSockets servers [GitHub](https://github.com/PalindromeLabs/WebSockets-Playground)\n\n### General Utilities \u0026 Tools\n\n- WebSocket King [in-browser tool](https://websocketking.com/)\n- Hoppscotch.io [in-browser tool](https://hoppscotch.io/realtime)\n- websocat [GitHub](https://github.com/vi/websocat)\n- wsd [GitHub](https://github.com/alexanderGugel/wsd)\n\n------\n\n## \u003ca name=\"bug_bounty_writeups\"\u003e\u003c/a\u003eBug Bounty Writeups\n\n### CSWSH bugs\n\n- [Slack H1 #207170](https://hackerone.com/reports/207170): CSWSH (plus [an additional writeup](https://labs.detectify.com/2017/02/28/hacking-slack-using-postmessage-and-websocket-reconnect-to-steal-your-precious-token/))\n- [Facebook](https://ysamm.com/?p=363): CSWSH\n- [Stripo H1 #915541](https://hackerone.com/reports/915541): CSWSH\n- [Coda H1 #535436](https://hackerone.com/reports/535436): CSWSH\n- [Legal Robot #211283](https://hackerone.com/reports/211283): CSWSH\n- [Legal Robot H1 #274324](https://hackerone.com/reports/274324): CSWSH\n- [Grammarly #395729](https://hackerone.com/reports/395729): CSWSH\n- [Undisclosed target](https://sharan-panegav.medium.com/account-takeover-using-cross-site-websocket-hijacking-cswh-99cf9cea6c50): CSWSH\n- [Undisclosed target](https://medium.com/bugbountywriteup/one-token-to-leak-them-all-the-story-of-a-8000-npm-token-79b13af182a3): CSWSH\n\n### Other bugs\n\n- [PlayStation H1 #873614](https://hackerone.com/reports/873614): Remote code execution over WebSockets\n- [Shopify H1 #409701](https://hackerone.com/reports/409701): SSRF over WebSockets\n- [QIWI H1 #512065](https://hackerone.com/reports/512065): DOM XSS over WebSockets\n- [NodeJS H1 #868834](https://hackerone.com/reports/868834): DoS because no timeout to close unresponsive connections\n- [Bitwala H1 #862835](https://hackerone.com/reports/862835): Broken authentication\n- [Shopify H1 #1023669](https://hackerone.com/reports/1023669): Broken authentication\n- [Legal Robot H1 #163464](https://hackerone.com/reports/163464): Information leak\n- [GitHub H1 #854439](https://hackerone.com/reports/854439): Arbitrary SQL queries via injection\n- [Undisclosed target](https://footstep.ninja/posts/idor-via-websockets/): IDOR over WebSockets\n- [Undisclosed target on BugCrowd](https://medium.com/@osamaavvan/exploiting-websocket-application-wide-xss-csrf-66e9e2ac8dfa): XSS over WebSockets\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FPalindromeLabs%2Fawesome-websocket-security","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FPalindromeLabs%2Fawesome-websocket-security","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FPalindromeLabs%2Fawesome-websocket-security/lists"}